[skmcgrail]

This PR contains 6 bug fixes for various issues in AWS-LC. We would like to thank Joshua Rogers (https://joshua.hu/) of AISLE Research Team (https://aisle.com/) for reporting these issues.

Commits

1. evp: fix DSA keygen error-path UAF/double-free

pkey_dsa_keygen() assigns a freshly allocated DSA into EVP_PKEY before EVP_PKEY_copy_parameters(), then frees the DSA on failure, leaving pkey holding a dangling pointer. This fix avoids freeing after ownership transfer by nulling the local pointer and clearing/freeing the pkey-held key on error.

2. 1-byte OOB read in EVP_PKEY_asn1_find_str length calculation

Fixes an off-by-one out-of-bounds read in the EVP_PKEY_asn1_find_str length calculation.

3. pkcs8: cap ciphertext length before allocating in pkcs8_pbe_decrypt

pkcs8_pbe_decrypt() allocates OPENSSL_malloc(in_len) where in_len is influenced by ASN.1 OCTET STRING lengths. The existing INT_MAX check only guards EVP_DecryptUpdate's int parameter and occurs after the allocation. This fix caps the ciphertext length before allocating.

4. evp: disable EVP_PKEY_derive for KEM method

EVP_PKEY_kem_pkey_meth incorrectly assigned out->derive to pkey_hkdf_derive, causing ctx->data type confusion (KEM_PKEY_CTX vs HKDF_PKEY_CTX) when callers invoke EVP_PKEY_derive on a KEM context. This fix sets out->derive to NULL so the operation fails as unsupported.

5. Reject zero-sized digests in HKDF EVP_PKEY

Rejects digests with EVP_MD_size <= 0 when configuring HKDF and when deriving, preventing divide-by-zero in HKDF_expand if an XOF digest is selected.

6. Reject XOF digests in DH_compute_key_hashed

DH_compute_key_hashed passes an uninitialized out_len to EVP_Digest. For XOF digests, EVP_DigestFinalXOF interprets *out_size as an input length, which can cause an out-of-bounds write to the caller-provided buffer. This fix rejects XOF digests and initializes out_len to the fixed digest size.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 84.61538% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.70%. Comparing base (1276fc7) to head (f9ba277).

Files with missing lines	Patch %	Lines
crypto/evp_extra/p_dsa.c	57.14%	3 Missing ⚠️
crypto/fipsmodule/evp/p_hkdf.c	71.42%	2 Missing ⚠️
crypto/pkcs8/pkcs8.c	75.00%	1 Missing ⚠️

Additional details and impacted files

@@                 Coverage Diff                 @@
##           fips-2025-09-12    #3006      +/-   ##
===================================================
+ Coverage            78.67%   78.70%   +0.02%     
===================================================
  Files                  667      667              
  Lines               113027   113044      +17     
  Branches             16068    16055      -13     
===================================================
+ Hits                 88929    88971      +42     
+ Misses               23322    23297      -25     
  Partials               776      776              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.